89bccc47fd42310c65e6a50efa00ed62fb97f2a7ab5ee0878eff6fb1d9a1d01c

Analysis

max time kernel
45s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Size 4.3MB
Sample260708-ja2tzadv6k
SHA256 89bccc47fd42310c65e6a50efa00ed62fb97f2a7ab5ee0878eff6fb1d9a1d01c
MD5 7d8b4e3fe03c80f181080729fddafe44
SHA1 c8cd01f6bd158d6342e49353f792db5cf5fe19b9
SHA512 50b9f4c26ebc551d3443f0c2c54a7f74eae23704f753477f14442298da97d48eb47377efef1733068be2c2fc4b5f1ffc7b20ffeb0a3c1c93d39347a460eb4063
SSDEEP 49152:vaRGf+GDHxuz1vKjxa1CPsFRuk3wwlgZKUxT2WHHF6c9OtutTzx4x8EVep:vaAXHxuz1SjE17FRflgDx2WJix8EVy
TLSH
T1ED26D002F7828171EDD29135287EA77E4E39BD28AB62C5D773902F3548306D16E3E768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
472	elevation_service.exe
5504	elevation_service.exe
2272	maintenanceservice.exe
564	OSE.EXE
4868	PerceptionSimulationService.exe
4700	perfhost.exe
5448	ReFsDedupSvc.exe
5136	SensorDataService.exe
5936	ssh-agent.exe
2804	AgentService.exe
1532	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bb7dff2984defa61.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\RestoreMeasure.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\java.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac9b7982ab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ec01082ab0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002dc92a82ab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004106e281ab0edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5f72182ab0edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074aef782ab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008626ca85ab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001d4b8f81ab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007f2b8282ab0edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeBackupPrivilege	5448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5448	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5448	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5448	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2804	AgentService.exe
Token: 33	1532	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1532	SearchIndexer.exe
Token: SeDebugPrivilege	5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
Token: SeDebugPrivilege	5632	2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2472	sihost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1336	1532	SearchIndexer.exe	99
PID 1532 wrote to memory of 5624	1532	SearchIndexer.exe	100
PID 1532 wrote to memory of 5640	1532	SearchIndexer.exe	102
PID 1532 wrote to memory of 484	1532	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_7d8b4e3fe03c80f181080729fddafe44_amadey_coinminer_elex_glassworm_luca-stealer_lynx_magnib.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5504

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2272

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:564

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4868

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4700

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5448

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5136

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5936

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1336
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5624
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2940 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5640
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2956 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2956 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2940 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4604

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:2472
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:1860

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:1784

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 856037af9b79c88c75a796f68d427a797b985dcfc6f9b22430a5323e57eadbf2
MD5 1129131cf06381078a2701d74a92d381
SHA1 fa069adfc4f0de9ca7fa799dafe71f07fdea7f27
SHA512 64e76753382c01b487d0af45d6b7d6a6ec7599ea33becaebd6fcc0f0f7dc0cd896c39f731962549a29a7bc7913132530990eeea349aa99386984c397fde8b067
SSDEEP 49152:cb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnux4x8EVep:G3q6HjB9ix8EVy
TLSH
T16ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 176f92347c27980c1870ee39979c118c966b0bd190c82f8efc109e306d5963eb
MD5 8ddb97f01573b0b782be7cfb36afd886
SHA1 627b92e2d372c81381802b6a8db6f90c5d51be03
SHA512 3693a97f17f6c1d7155f32b1aef3db6b075a27b3e4b833e85574a0c8c5f47aec930d8df668aa309644f608374fe442519208ad0c3a53c6371064881b61c46f47
SSDEEP 12288:Q1XLsswWkxy2lRq2czAu+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:GXYfDtczAuyxknw4FYnshx8OfVe247
TLSH
T1DF75F12877D508F9ED6B8139CDB28512E633B8514770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 02b09296b0a2265d558d9f69b7381ddd1db569dc80fb84e912688affdcf70be8
MD5 ea8a8a7252bc53cad715c536dbeb2c0e
SHA1 4157e03e68793d167044a044da892e42b8588b68
SHA512 d5cd0b425486d46a8b7ab859ffd5b1dd9952194fe102c3581491b93ed4e7ba52d2317e763193d1c39bb317e8b047f8108ce6ce031f8fe2e04f1ef6ffff4392d3
SSDEEP 24576:w0Le5ji0hmx1rMzyxknw4FYnshx8OfVe247:wPji0A77x4x8EVep
TLSH
T10695AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1711b910c4623abe810eef2876f4aa34cd8d2ab6746af83c061a1674054d98c0
MD5 43d0553bba61bca5d20ba309991d8838
SHA1 631f4d3602d23ad58ef2614395e5ac9a97871c78
SHA512 dd786859bb3f38127536fa5e03a42ea765d147eb1e849af8db5f8c4292fd5379217304cb068306e0cb6eb849179ecdc2ed61d7d5d3c4e440f6d6db889e1ad276
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyuByxknw4FYnshx8OfVe247:g/ezSC6vUzPvxHjyfx4x8EVep
TLSH
T165756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 10c008420fd9d1744e09e85f563b70403d6f7b34808ecccd8ceade8320b34bf7
MD5 bef4bc084728eafa3994823ed1a1cbe8
SHA1 e03c944793ed09d7a5a3e59e9488c71c96c1ddfb
SHA512 a2385ad0d516b5b7425ad3fe7e84dbb923a94a9e12dcfa3bdbb3039279e0f3b4708643edd850b7d8ca1bee27cf414d30e63798a3de0c808a271e42c216077c92
SSDEEP 24576:SVbqPb88hv/l+6Syxknw4FYnshx8OfVe247:SVO88hXl+ax4x8EVep
TLSH
T167559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 7a20494e48d431011fcd8b736b4fb2eb89beeb235ad273e96dfe34f6ef02cd03
MD5 47af3192e7bc4293215389fcb8b1f57b
SHA1 fb779419b41f5b67908db13ca4005c85b96296c7
SHA512 d75966620058992917eb96413be38f8ba3631448b0170f0224e1239ac03f6930c42de886b2fe4ad3c631c2531b38aca57eab83135ca39848498a0f339880cfe1
SSDEEP 12288:NNn+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NNnyxknw4FYnshx8OfVe247
TLSH
T1F465237CA7DDA4E1FA5E14331B7572622616B9A0DA74C11BC779B14EE0F0CA0E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 79eb1bb40a367f62385d5b4aca678146dabf7b2941a01fc498fab230ce349cde
MD5 874ce30a3d9ae88e96fc9b5ce7b26244
SHA1 0b38ba42a982a950f32eae30102ff6737ade4c42
SHA512 c0f69be20b0d54f5013a76e84201e0e2fd30aeb57aca7717c0d5f535e42aa8310f98955041bae78181e822053247217419b5a1982da152f5a1e715e10892f8d8
SSDEEP 12288:+eBNUbTVO86U6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+JIU6yxknw4FYnshx8OfVe247
TLSH
T16C75CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6f7a5319fa19cd03dcda9c3319dc1327b74f302e164e74b1b72a8080b484f334
MD5 f074d428fe049a7c0f6c66acad7489ac
SHA1 cdbe9921dd1e506a22177cc3601196a7fc778aba
SHA512 e96d7767d539f74f05e82193016d0c28cdca12ab3bd32634d793c2e3dd8de93ac756b19888fbfbe0b33f19b80702733c44db010bd98613b0c14245343e99dbfd
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:OQvGAdlCEL8c/yRNw5CUix8EVy
TLSH
T17D267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 03b1356ae8840dc700f9b29ac2889205ee5630af6e5fab731b42d4b471ff2405
MD5 89809596fd258a379bcc4307c4977830
SHA1 709c2ebe4e2af4f63a74b12ce4f79e3c5c45de06
SHA512 dd19e8d84e5c794b655b3c6b821a335671e06c00d94b95098b2cf8abf316515579435ca72b06e9b31a594601cb3ebbb2e6582005baf32e1240172c76e6ee6c00
SSDEEP 12288:LAwSfxL/2Dc3LDLLmt0LDQewsAjo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:06ewsAjoyxknw4FYnshx8OfVe247
TLSH
T13685E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fe85047714f4cd080ad1b64c50fe4967724a4154f7a258f4db23f62e830167e7
MD5 1b00e5bca1b2248b18778f4676b279dc
SHA1 aaba8607a057fde0032cba3f337a914abc6e132a
SHA512 959486583e5f8b242f6b4720d18a1b4a5bfb884f8a8d35085867515cf020379f6886474567a393cedfc4b338c506368201616f0765ffa685230b5a1f8f08e456
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2:mUEtQevvqc2W1cpV2EI32
TLSH
T190474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 851bc5df8280a28d37f76f1864f54bcb473bc877e9a515e0ee7beae84a17b397
MD5 d966365b7dee25a048cc0603a4fa530b
SHA1 8828d4d8a124a02f7438683e79a804732d4fe90e
SHA512 d437e3f3af8e9bf848a573522623a33379e5d6127bd8236ce6e15d65ba7958ef4c6dbcbf3179d00cd3d44483de80a2789566d55ab0252444e0e1d0cf22958810
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zrx4x8EVep:0oqtVjnm4ix8EVy
TLSH
T171D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ece1637058361a6785a32062f8c08b1c24da62dbb1d785e2d1baaa7bd164349e
MD5 e8748c8fc3be980938d3bdcbe697e1af
SHA1 855c0a07cb32a15168282c828c5c4e2e608f2158
SHA512 bda0287f1e662cf6a4baaa96719f909f28b3af19796d91fe76cd7e3bd1d3afe7b5b54ee9b13885f24182e4ca9b68710205445320d4445f42f10510e27e54b3f0
SSDEEP 24576:lAhGLJIFoiwtA5l7S53tyxknw4FYnshx8OfVe247:lAMyFoiq5Ix4x8EVep
TLSH
T1FA35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 29945e1cd0e955c1997bc833604300f4d029c91a69c9925ea99454e017cd296d
MD5 205442a1c3c41c59c7bffbcb43b29858
SHA1 a1f74563dabdc76e2e5703626ea08ee7229f817b
SHA512 7358cbf8289e64d19667335c2c5ed326939d967a1a5021e9daa53810c0dc32240200e911b0425bea6bbe38ed6658be3986c9db405e844cb2d7fd9a54b542042e
SSDEEP 12288:5mw5HEjsChN4BFgl0WDm+Ch+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:UwuVOWkyxknw4FYnshx8OfVe247
TLSH
T18E75F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 71abc54ee2d03995e3b74022b4e3c261f4fc2860df626515d0e6c92688e29049
MD5 65a86673190e8714bae0a2716e8e1c4d
SHA1 f11503ea4c6d3e8008e13712ea68f8e9507a35c6
SHA512 3f5db37058ba9dc8ceec3536427374294e32738626647cd4a473d04c07148643b44cbb8c08b29251891c48ec26feb451c49c3e7a2c3446aedf7bf5b183e79e95
SSDEEP 12288:fFZ1Iy4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dZubyxknw4FYnshx8OfVe247
TLSH
T17F6512AC33E860F1E1A7113A89F15205E76274A2677183CF4764A25EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fb69da7b97c944130470ec1765d2dbb7254e0a4f698909078430e1f8eaddbf51
MD5 e0bae37162a730d65e91a97725498794
SHA1 74ba87a04ca0c68ebdd365c1ddc374ed765bc607
SHA512 8e97bacb1c4bdf61c9f98b5921ddd0bb6988b784008b303dee52a9c93262f33afb612801e2bbeb82420f587ca8c6ea94c012ee1adac9bad3506dbf7e4a54c6e9
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:BQRQyi36YOcPQLvw2gAf+PN3pix8EVy
TLSH
T178667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e74daba8b6c002f8f6d8a24f008be5072a73b7caffdb40f589616e73d0aab95f
MD5 bd21435d64bdb480b19269f3f584b764
SHA1 2ebb0e6dbc13b03f6a7eec77a7f688dde94f00fe
SHA512 fde361d650d30212c59f36cc9360f42ccfbab642d08e96969c45b7241c7e3b0ad84b176d30de89604dafb7765a30adfd1477039b44fc42ab9d7108560c8732e3
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UR:XQRQyi36YOcPQLvw2gAf+PN3pix8EVy
TLSH
T1D3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d5dcbe6232f12448ca8c7e60190901240ebe3c0f48075c0889a3f8d84b04489e
MD5 aab64654236c3ce6c2435ca3c9ff6bed
SHA1 84a13962dd3172bbad492eff27ca73a7bbb2f6c5
SHA512 50c2ba47e43157c07ca15105204a5fea2a88adc335ceaffbea3b30c82fcc3d33197728871f69180cae028782dfa62aaee9c8366763bdd23c97b7805112c401cf
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0Lyxknw4FYnshx8Z:168Qg55nhheWu7PNU3/7x4x8EVep
TLSH
T132B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 38b62d42868b9c13c3177489bcf956f69df19aac50168fda24fd27c8374d05e5
MD5 97639a3173a24c817a9daa2a5491e392
SHA1 b183b84fcb0e7afc82f59c1a1174e1587eb4020c
SHA512 d9cb08a54df6ad681df69c5e8c4262d3ccf1e94d46826dacdc74487e49c1457584e2988708f4378b3a3474defe695d3e3b7ab11675fba3f079634f19d04d10a7
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99L:by5112gYy5azzVvL69nLKnhZyix8EVy
TLSH
T1C1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 046e5a26b4df78979bbfc1ef8f1671f26597bc91b2eb3a3ac1e3c99be0cdd66e
MD5 ea5bc85be94787b0fc7eefb2414755da
SHA1 dc36fabda306817685dad545a8a3e3f9181f24dc
SHA512 66941ea7f915b5ce1050385f27779ce8d82a3593cf337b61a935918212b8a0847594e273e34cfad7e1ebd33f81cc8d06513dab38184c80d0e951fdb19787e1e8
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRx4x8EVep:du6JmVxd2dRix8EVy
TLSH
T18CD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 45a0acd6a0ad439df340c6632919739b251baa3ff4423ff4f9e36a547ec40feb
MD5 dbcd714514ba29274433844deda65e7f
SHA1 84ce40a5fc8fc441b5f1a750b4c321923ab73630
SHA512 b03c8570f8ebdfa10ddb8ef9a26dc7f7922530b5522510e95081759d8655c6f05f26b9fbc06adaf86ee99830a2baf3620dfe6804951ec8328537ded6f160ef7a
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4x1x4x8EVep:kmifPbR4ix8EVy
TLSH
T180B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c79f00f9e005f7c8923baf3716b67a145cb7e516355cd6a0250499202c03beb5
MD5 985b31c3d8deed62d2d43a8887d5ccf5
SHA1 183864eb4902f9482688f71697f983ddfd48b983
SHA512 bb86bb85a1da69625f1490ba8fdfa0fce8855c40e8dc2f7e1f419e53fe92ba32325e1e0578c4219ea58448fe16460a49f93bbc81e8d26daca63850996c38eaa4
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHq+x4x8EVep:P5dKTi61+ix8EVy
TLSH
T1EBC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 10ef6a5a4cbd7ba1593f8097fd449ed4003495de168ed36e84b944ec618c5127
MD5 7b5c366502167ca9a2918278f57ffdab
SHA1 85534958815f1ec37a8186f1c2d767f2670fdadd
SHA512 3556bab070008519920aae35b1cd5c8781d77275a2c8b682eaa3b0812ff57eef74e7ba8a586ddec315e74a557f2f02e0dde60afc256a513c3a6c4772bba5d57b
SSDEEP 49152:1htSn8EApI0figngiDn0AP5whx4x8EVep:EX2iyphMix8EVy
TLSH
T13F95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 c3abdb02635c774414ec242404e5e3321eed7057ec21c2a537bbcc66210a9437
MD5 01f2122e95b22791127b91f632d59405
SHA1 8de23fec2e3e5400510abf54ed83bb8379d3f910
SHA512 311b4596ca91c463b3e99062e7a300416e2d0b9d2d4b439a5e1064d7c6e78d05534e307603f5fb5e48901253d3c7057bd5730b64fce58459393d3d11db363b70
SSDEEP 12288:mv+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:mvyxknw4FYnshx8OfVe247
TLSH
T1DA65237CBADEA5D2F50D11734B7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 9873056b8a655bba06d17370ea5a3b8f3300f26877c3c49e016c1ad828a1918e
MD5 d344730738dfaf8cddbd698147f16219
SHA1 dd0d63c32f277b5b3af6432c3f7f37d01b68faca
SHA512 62698ea3fd4a462a07a83b7a63efb48bb92b55c0f10b51dcae98800f9840a871c63446f8b91737b23ba9b2a3e8beee23bdbf858c1dfccbdfc1a91e8bf548fb6f
SSDEEP 12288:B8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:B8yxknw4FYnshx8OfVe247
TLSH
T1E165237CBADE95E2F50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 cb78ba18c82d8e8896ed78cc576705c7f826d8a59bb184c80cb2b8e9f7d355ce
MD5 e7565f529dd1db6c45ed526df8077372
SHA1 d510f029fd4041279d399c38f4e423f7b58d43d5
SHA512 ea4d7f533368e115bcb2665ef4eabb32926a64d9478c61ec524a40e72deacbd09d254161f6f7ee52f40ecd6f74fef9a8ef0638cb95346e09268f278c8155157c
SSDEEP 12288:+C+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+Cyxknw4FYnshx8OfVe247
TLSH
T1C065237CBADEA4D2F54D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 a517e7c974dcb458a203db53d9996da20d9b52fb484b59be7a90cf3eee00eedb
MD5 85a5c35b9b044314871dc42822cad2dd
SHA1 9f8922e87874d803d75c71d19805de12e4b5a627
SHA512 923318576ac1a9352bb898773bb2c253843673ddbe92cc62871b8ebc776faf559166f333112b910de03368b63e68ee2bbcdd202dcf6b3cb548415a82f65411aa
SSDEEP 12288:0VN+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:2yxknw4FYnshx8OfVe247
TLSH
T1EE65236C77EE50D1E85A51738A716222B365B8E5E731C35FCB24710EE9B08A0E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 0d53532fe3fa0992f8a5756ad901e11668fc5c2936dcebec3b2ef5b20e7dde6a
MD5 3ba6860adf945659fea2b0f7163c6353
SHA1 3e16fd273fc763a79054d6ed937cd94b1de7e0da
SHA512 868babd7316d19189daff84d96a470052ad1ec4d9df1e8eb362b86b71237efd896b55e59441f801f04735330a10916da33a7f378276cfb39641e247a9624d5cb
SSDEEP 12288:JF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JFyxknw4FYnshx8OfVe247
TLSH
T18265237CBADE94D2F50D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 5234e2cb4ce9f0ab8daf62bc5558435c722fe1e2f4c03be666194958434164b5
MD5 c97e5c94a559c931300da02d6738713c
SHA1 3a25e38c6414352a983450d48ee203ef8bbe642f
SHA512 59907be5686b76acbb848f4ecbacf98ca6ce225585887fb3b409b3e8b4f0f252bce9a05655cf7737be54a85b1b93336bcff0b916fe48e1d157d0334a83c55757
SSDEEP 12288:sw+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:swyxknw4FYnshx8OfVe247
TLSH
T1A865237CBBDE95E2F50D11734B7172626609B5A5EB71811BCB6DB00EF1F0CA0A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 26efdb7bec77389328bb0f9c0d076656480681d6a18918ea6136d8f4ad1c6329
MD5 44ab9acfcaea9b2dee2435b84b594ba6
SHA1 4aaf03174f61db63128a7126175bafd4c8987bb1
SHA512 67b1f2f06c1c48d1782fd99f06267c87b666f928f131202d463178bff8b5f36a96babf19b4dfbead0876319cf4d99fba15e4b713215be0aae527a85d79608437
SSDEEP 12288:zU+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zUyxknw4FYnshx8OfVe247
TLSH
T18A65237CBBDA95D2F50D11734B7172626609B5A5EB71811BCB7DB00EF1F0CA0A02EA63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 51ff7c79183fb06c3861092d2ef1c37c08d247f694d309a277a3480bfc89bbec
MD5 251d2e5c9290b0f148eb98d220b56f9e
SHA1 ce1af4735528c5eb1d7752f12fea8085a01bfed9
SHA512 981fa607b72201662cbaecf7b574f1cfb6c8fb3395421d17903fa972797e5be24811ea097e3d07150617365637bf5c4609880e4725db81864e8e19f44ec34104
SSDEEP 12288:eiZwbZzzFEoS2cPvyc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:BZMdzFVSOcyxknw4FYnshx8OfVe247
TLSH
T1BE7502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 3d3c495d962df24c56688d56ed9ce2f271d5b5cae8ce2fa08b63c861fd05366c
MD5 488dbbf8c4127da01aa1f76229a0546e
SHA1 ada60f1f0d4439bea6f982ec0e82eb736404810c
SHA512 ff35864622c0417945e631dc1f8e994410ab918945f4f0b80b9063670e6840a276e9243b65a415af4229c4f77020aeeb2e1d3e4a3866d6864816157a8226444f
SSDEEP 12288:ar+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aryxknw4FYnshx8OfVe247
TLSH
T1E465237CB6DEA5D2F50D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 0de9ab76202ded01306adf8157239d4a43401352005be67e5326c049fe6be8b1
MD5 92531d658c2090fbab80c213cee5ace1
SHA1 bcae81cc6c4344cf1aaea630970a42a05da4c527
SHA512 a15159d863497f5163c9d3ff33f89892595c62de4ce135bf125cf24e925233e40ea15164ca48369193d3ce826e9ccdf63595307acfe3a076a79ef698d5539711
SSDEEP 12288:z3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:z3yxknw4FYnshx8OfVe247
TLSH
T1EA65237CBADE95D2F50D11734B7172626609B6A5EB71811BCB7DB00EF1F0CA0A02E663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 0fcc30e8ded40e8885ac34aaad26aa1e17b3db0a0fcda065ec8167e4c044bb9f
MD5 7a14f28501922ee87db6d3c435b23831
SHA1 2640c06c00b7354bf900235c9f2829d1996f9bd7
SHA512 e8e03559979e63217e5d80be09e521537061a97a09e6909cee7456c13bd6c1c963c6e2c82b519a03e4471414fbb1a18277e20714dd5297f3ff430b6c4bec2b78
SSDEEP 12288:+yPz5L84+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:jzy4yxknw4FYnshx8OfVe247
TLSH
T17575125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 6acc211eb9d69d7cbbf796af220d08c62576b9c216be1286470f0b5e6bbf9b96
MD5 e0b75fd6527ab78477c5d81e9db95e11
SHA1 50aeaf780109d009c3c329b78c6e9b748e833128
SHA512 ea989f9c43a7b6168d5c5bfcf0659d1340677ba74721b73e436274ca42dd6556a8a30109332ceb7afff1cde025d2f257041aaf0098f03175a1d2ebb95b5fc612
SSDEEP 12288:ar+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aryxknw4FYnshx8OfVe247
TLSH
T11165237CB6DEA4D2F54D11734B7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 8da90a58c792f33bcdffffecba07b5b630d017bdec5f531fb559c8dd51e2efa4
MD5 ca3342dac96b31876bb087dfc426606a
SHA1 b0469267b6c9d18db62382c0d2bb33bd1a234bf9
SHA512 5149a33e77b0eca3535544ec28662b961db879f6f052b7dec91c7bc93362668ceaa2b138223703269e695bc2f4fcc32cd62345a037df9d844a9f5247f8e09771
SSDEEP 12288:qr+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qryxknw4FYnshx8OfVe247
TLSH
T1C76523BCBBDEA4D2F54D11734B7173626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 08f80b7c510fec077fdb9120be875b742f1b54e662c6beaf366651d1ee77649f
MD5 416eb4d8b842577d531eb4b4186ec679
SHA1 8055b666bd1f32740506362b2c1be5e77f5abe10
SHA512 2ec2016589df955cf3ee99c56bb81755a93841b5f4bf458f9dea3c8ff7e7e4b9156fcdc77ba05452df5c429afb0f9b9fcb1f430936926790b314e24bde92267a
SSDEEP 12288:kyPz5L84+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9zy4yxknw4FYnshx8OfVe247
TLSH
T11175125B73E530F5E13A4236C9621612F372B872473086AF87A4527A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 4d314f4f0a27cbeeb65bad46f3eacb3c6569484004970a18c1f43d739af56178
MD5 07f6692cb3f311e79b21adf7ec5be7b9
SHA1 e2a4d333ba5da17bddede101bee2ee36f9c71448
SHA512 24c72bc9bc5d1140182b0615009dee9378a4a11573bb8cde922f03b525d8721b692a9d485e944dfd4337bea1a7d1217c263617d4c2b749caff37b250cef0113d
SSDEEP 24576:vTGaLl3z0zDyyxknw4FYnshx8OfVe247:vTFLljEx4x8EVep
TLSH
T13E7502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 5bae572cf150a1b5d63673337aa0e3af0cf202c3722493ec08418e4f69120c9f
MD5 f92109c15fbdc902439b0a545d8c3122
SHA1 d45a9380b108f0ba2ebb226791217b24acabdcb5
SHA512 09a91d2f8128b4d22b1a00d78d4f0d91ce89f3ff37e4db77713575b4901132950b53826acab616b7379490887b98ea6a1cf89ae832fb3948bd44bcc1e739005f
SSDEEP 24576:O3Xd9CHKy7GZWyxknw4FYnshx8OfVe247:QXd9CHKyaDx4x8EVep
TLSH
T13095DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 9dc6b2074a845e6828d2a3911f87edccb0aedf2c92914fd7a15635902c0410be
MD5 ee692fa2887906b4d6ad82b83e3b0fd8
SHA1 448eb434400c204164089df4c9a60f7681a9c9e1
SHA512 0934795beec43b843ef65d3b05fa877d2a86c2bd5b3d4d5830ca320a64396e5e8653a2beca65146583bc2b1da07dc8026b3fae73f9119e9ed375c0c7ba0a3614
SSDEEP 12288:6i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:6iyxknw4FYnshx8OfVe247
TLSH
T1E765237CBADEA4D2F50D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 91812919a4dc3bffa1bc414d617b5da21daba0b4be6d62d69fb625a9a7a84c08
MD5 6d5a3df552b953c1fda45eb1c5268ce1
SHA1 811d0b15166c57ccc37b199bde03ac3ffd8e5b28
SHA512 6314851ff9bce8e647d9213ff1f1683dbafe59dd0cc3666f963f0f69fd9a12fa2996343600430a80b903904ab7b509e5983f07f224cc8f309e63e5a27e79b9a8
SSDEEP 12288:SY+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:SYyxknw4FYnshx8OfVe247
TLSH
T14165237CBBDA95E2F50D11734B7173626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 462e2d5df945ce1b61640763612b9e9a9c053c3197a12c5808d9f4e3af5b1c71
MD5 98f565e0933f3a91b178429e5e352c46
SHA1 35c782eee6cbf14e05d32056840ec839dfdf7340
SHA512 5297acf9cb402c884bbc9ecbd8db3788ffb498a5bcb588e4c9d55a830f458073222d8c627e26ee04f3e69d5851fe51e5374263506104cc24e821ca140ab6a97e
SSDEEP 12288:dZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dZyxknw4FYnshx8OfVe247
TLSH
T1B46523BCBADE94D2F54D10734B7173626609B5E5EAB1811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 2844513919d7c7b97837bbd5419f0d7edcd5999e6532e70c6ba3731cc97d34d8
MD5 740dfb34e969acc6a7dfe5ba1ebb9e97
SHA1 1d7f94e147e244d22a42d70c2cbd351340a4a911
SHA512 69af28e9fa70e6bbbfec43640f20fb5ba35018af374597d2f24b591d09131291b2f53ca5090c59c63313ddf0e2af1281b3e904f9fd5e63556df508f2be34afde
SSDEEP 12288:Er+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Eryxknw4FYnshx8OfVe247
TLSH
T1996523BCBADAA4D2F54D11734B7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 1fffacc6ce8664bbc5189b4f427a9ea494a78215ef2742c09a280864e005bb9b
MD5 589b3d0de415c7936ee3874f2d854a81
SHA1 fa434b3e7788ac2c5169878c44f10ffa79ac82b6
SHA512 e434c15a35b1243a7fe97d76b0233e69ed8ff3d32d29e54d256cc8331e275dfdc7b16246d07f3077c9ec9bd83bf81c8c4c1c20f2c2d5c7e90048b9da189abc39
SSDEEP 12288:7i+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:7iyxknw4FYnshx8OfVe247
TLSH
T1DD65237CBADEA4D2F50D15734B7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 cbc16497223914d7a01b9c0a4200975a3f8ba15811ddff61c3aeb4c8574109ff
MD5 6dbbe11624f56cc585e699a06f36dc97
SHA1 8987296834c329dd64152df71aa457b7b300426f
SHA512 02a48b79551f4bedbc19c51a9677ca3363d364d58dce02f293cb92a1408c2cbf50cb272cd2ad9a5f8f9246baeb1a6958a1eca06bb0deb5311e68c0954b7547f0
SSDEEP 12288:Hj+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Hjyxknw4FYnshx8OfVe247
TLSH
T18E65237CBBDA95D2E50D11734B7173626609B6E5EA72811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 51079b0c4a55d381b93af3e9b468adee4d99dd2f3d8de75cf8643b305f6a34d5
MD5 7ef45f856631ab8b8d7f90d13f4fcde7
SHA1 f86e95fb8bcacc935ef804f2b8764f2bd86632f7
SHA512 3eb0044ba5f07e96c3b7dddb9ca99111d2290d1c632970a4ade0854842c26d06323e732c8a9831d42f221137ad6a6fef2f320c3cc1c862dec98b1f176d8e3099
SSDEEP 12288:dF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:dFyxknw4FYnshx8OfVe247
TLSH
T15965237CBADEA5D2F50D11734B7173626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 e770dad885671047032ad4748fbb7bee6716ac086357debd49c77e16ab1e1b99
MD5 e2a690c612a1cb3025d9c41123c703f0
SHA1 ae333fec75f05233705a73378c2a9b891974b7e6
SHA512 442f41ce2a17dc5e7e0109beb9e941fb2c24dc38ae47c7efcc72fd12dc4cb20bdbb32f248bfbce85b3bdc39316b2da2c14863dd09c6132d8c19ca3f8c21e2b19
SSDEEP 24576:TfwvJk9RX6wkyAIHyxknw4FYnshx8OfVe247:MMnYISx4x8EVep
TLSH
T1B895CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2a238619c26e06133bf4ab06d57444e1894d311c908d4822122d8652afb9d53c
MD5 dfd7df6f4cc02accf3febf89ce152f51
SHA1 cebacb1bd05164b40d84cb985b5a1fd0581a6b0b
SHA512 40b75f9c4e613e421bbd34227061e3a77f49b8e27d24cced20d8c4c47bb666c34016713ed98a0824efd0476382a6b2a9d27d8a871681ecff1110920313888a84
SSDEEP 49152:NYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Bx4x8EVep:NySzPJix8EVy
TLSH
T1FE066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 bf715a7dae055af3c413d4fc7b41f79b9f572163c4b005a64bdf22a2541c234d
MD5 e02001898575f9868c1b1868e779e95e
SHA1 481f91829d402505013b17d9bf28dc773fb6e676
SHA512 0cc0d86bde3ef729da2717329df6287a2a7af4d68e54d474bd318f890f446c1771bf39fcb17281805af0e89eac44ac26b3d31bdc9f12aed386d562b9954bad90
SSDEEP 24576:M47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYsyxknw4FYnshx8OfVe247:M47JUQj1irIhCnDHUPfF/Rx4x8EVep
TLSH
T1DB65AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 49be57366cf6466d647f1f50f8332349da586f90abd455775eb77a212c4f6eca
MD5 131c3155f43bd7c3fd5c82724e2912b0
SHA1 ebc053868f54c3caa3dbf1d34c74b87bfd5b2b1c
SHA512 ca646f28167f7993a2e514ec348048921accff9d7a4f16ab610174a0e3f4a99459d571ce8111224f1bedd4ba9ab0d0eee5ea220afb0bc1bc10e2c5d98781affa
SSDEEP 12288:c+sfb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0byxknw4FYnshx8OfVe247
TLSH
T1BD75F028E29802E4D06E2176CB625641B3237C6597F1D3CB97D0F13E1F71990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5a0426c9111bf9c9c47e421a709573b6ab9c97dbbd454026dc37d4da6e485ebb
MD5 781c2731e5e1239db8ab487ddf0914ec
SHA1 42739c04c7793e167e0fc1b3c5cb13a7dd6a26d9
SHA512 13483fc7c39f5d7bb6e8656c7e93e8a63fd00df310a3607e347a210f7e8cea25ada1eb7606dfc69a287fec1c177c4f2caef04c190b446b055002b2255d43c63a
SSDEEP 12288:PhfRti4dUf8wXBnzr6reFaDshoDWkE08Ye7S+MEdk7jKPwY:PRXW8wXBnzrVyshb+8d7S+MWk7jqJ
TLSH
T1D14517117666D74FC6AD40325E36C1CCAB70BD41EE45AB0772C8873FC5B6658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 bbb6e4a7761f5db8c285a76aa99e90561c33fe3b4e237a6588e6fcc8e5e1af16
MD5 b301f6e22c63fa0063c30671266e29a1
SHA1 5ee3f01a7e39e9dcbb291f5f9ee57701cb1e5efd
SHA512 4575d3ab1d0a0b5dcac4a1129656058fc06298f19620302551f47b5629763bcb0e7ff9cecfa63d683679525cebdcc02eb90eeeb0580e872e0f3cb27c6e9eb297
SSDEEP 12288:/fYRf78wXBnzrt8wXBnzraAqCSDFdTdHs/7K3ghldjl:w8wXBnzrt8wXBnzr3qCSD/wDd5
TLSH
T14065E840A537B38FD1B75072072A9B8DABA4EC02B7056F2677CC443AD86A755B0F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 a70c2d34ad0062ad6981cf908d2514b4024930227d32e3b3212bebeb96a3610e
MD5 379e4fdebdce7beb287abf24081983b0
SHA1 e1b2a6872daa78d27ce958427601e5225ed0e3ec
SHA512 7206f92faf796c4e94734e20f4237b437e71d0f8972501cbd7a10399b2b2215986e0e1d34ff2d7143f26465f8a935cb0f6c26786c9351d1e4608600ff7633bd1
SSDEEP 12288:k47T+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hTyxknw4FYnshx8OfVe247
TLSH
T1D165237CA7DEA892F86D11730676A221360AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 23836c270f7ff4b452c6455251d8703baffc79dc98b0e4367172b9a3b61a2359
MD5 3c90ea2295dd7ab3ca0e63e86498bf5d
SHA1 e3c0a93ea00af838cc9eda038ff52485bd5e911f
SHA512 ca209bd8cc8ea029bda201ccbab65cd9e328d9f453c67cc441f05b1e525b5cfb32bf21f296e5b956811ec55ecbbc8d562a54d2cb964d314ffd2e905401383b3f
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYByxknw4FYnshx8OfVe247:Xgb4mBIBhGFHx4x8EVep
TLSH
T1BB65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 e8bdf4e511ecf0393e29908a8cb4f4961736247ef8d3b53c79991c62dc36bda4
MD5 a6e79706314e53d885250b9ea13be50e
SHA1 98a9e7285d2a1d03e8831581b6aee5c72c031019
SHA512 1b30957d7eb19c5fe3b671bf1a5ba70ccc967536902cf94d08bcbcc1889acbd33103bec0514fcce7405002d787c4d1a72c9f628431e00007886f123178bfa55c
SSDEEP 24576:FG88u8FpJqH1azria7/mcyxknw4FYnshx8OfVe247:o7ZFPqVla7/8x4x8EVep
TLSH
T1A595F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 02859bbecdb7542bee5cdeaf077b99d86cb1388dd605ad7e04eb952072915a73
MD5 00b924d83a7ab7b6e40c3aad65c8da19
SHA1 8df66585d9789f388126501ef002d52ad944ab9f
SHA512 15edd377ba634ab90742e77d92b16fc8723bea1bfc0d70c56b8a6ba7edf87caacd48a068b96bbbbd2b3c10b1aa2c5f4f64eb524fde9942b0911cf0a9902f1248
SSDEEP 12288:eHvUrBFrEjwaQA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ePUr+NQAyxknw4FYnshx8OfVe247
TLSH
T11F75F12E22ED18E5E67AA17D89928319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3c4b577321239c5355153c76305a8a3c0e892652a53789bc3204dde60031872d
MD5 ef1f5b43c59bece6fc864bf92cb44c7b
SHA1 6e6faa4fe93df14344a3ee529ea2f1862bf6dba0
SHA512 c4e4bb15faeabc1d664e695c0ddc52d8e3508ef73aaab2a9f886617e3b7c58a1e3f2f75b1fbc3f1d66845cbdb57b3265e1a7192b310a81c67272f566b2da5877
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzx4x8EVep:hG05lO43bqix8EVy
TLSH
T1D9D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d0222e3a599a99db6cbdb4f51f1e68a83956bbb594e5d737ea1c8c5b8fd42783
MD5 ba4207cde8bef08900e213a25602d30f
SHA1 7cb6f93a4d20ba3cb500a299f036078e0b018f96
SHA512 a19bed0ec2434f1342f4e39fbc7b3248996939ade17adabd53e995cd5a89d7bc78d315ba91dfc23323f2b5013f2c5ba699bca37fd7c55062db26e5b7fc57b6d8
SSDEEP 24576:/fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnOyxknw4FYnshx8OfVe247:Ha5POZ3+Jt2pasx2+m7x4x8EVep
TLSH
T1E765AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 de20b2019178cd65b0ab8bae92ebc762278e3b44b404e88f32f3665af776f401
MD5 a0df00aacc35ce2c411a3ea467cd3bb7
SHA1 4bffafb768b8628924f51bde407ed2437a47985f
SHA512 2657cd656b5404d3001300b480b2c0774c7c5a34266be84c14281bfbfbfae71311d8933dad58dfebf21847f41090211d1e0c2f0692a27faa5b9d5c4c42c472d1
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkEyxknw4FYnshx8OfVe247:hNc/zEOVHFcx4x8EVep
TLSH
T152857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f7b35356972b735f98d6caa750afa92bcfd804ea051fc25dd4fd34df5355c7e5
MD5 28c37aa1c3ec5308730937902194fbf2
SHA1 c3a018f6d1e50503fb91773134b6dc80bddffdb3
SHA512 4234c7d50baf1a71a23f96ec17daf77a3f0bd6e73e2b53bd71bd97cd1c1bf1adc2535689556a5e30b2ee0a006cbbdba39848078fb28d45e4ef5f8983d808a6c9
SSDEEP 24576:18kNvNnaFeYhJNtmZBmKyxknw4FYnshx8OfVe247:18MwBtOmlx4x8EVep
TLSH
T1BE55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 7198a78ccaa2dd80cc2a7e0414f91f122eef086afd3b25c7737642fcc5209cd2
MD5 bf6a0b59985c7c4b73ecc8ab85fbf3db
SHA1 6da8092ec8edef75ab688fbc306f12a8796cbdec
SHA512 388e98f586f9abbcff26dc824b810c9667d38da9fe8d65d4def65decbc9ea71f714c552677e21707433db9990f8d6433a673959adbaaa3e0f74930777a20b434
SSDEEP 24576:DD3FHshBIYQgAPyxknw4FYnshx8OfVe247:DDVHeBIAA6x4x8EVep
TLSH
T13185E17DE79C04E4E57AC1BC8A638606E77138A9033256CB029491BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/472-14-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/472-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/472-20-0x0000000000E20000-0x0000000000E80000-memory.dmp

Download

memory/564-58-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/564-48-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/564-52-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/564-163-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1532-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1532-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1532-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1532-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1784-348-0x000001C2801E0000-0x000001C2802E0000-memory.dmp

Download

memory/1784-366-0x000001C281C60000-0x000001C281C80000-memory.dmp

Download

memory/1784-380-0x000001C281C80000-0x000001C281CA0000-memory.dmp

Download

memory/1784-394-0x000001C2942E0000-0x000001C294300000-memory.dmp

Download

memory/1784-350-0x000001C2801E0000-0x000001C2802E0000-memory.dmp

Download

memory/1784-349-0x000001C2801E0000-0x000001C2802E0000-memory.dmp

Download

memory/1784-367-0x000001C281E60000-0x000001C281F60000-memory.dmp

Download

memory/1860-500-0x000000000F570000-0x000000000F5EC000-memory.dmp

Download

memory/2272-39-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2272-57-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2272-44-0x0000000001700000-0x0000000001760000-memory.dmp

Download

memory/2272-37-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2272-60-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2804-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2804-133-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2804-125-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2804-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2804-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4700-81-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/4700-229-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4700-79-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/4700-83-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4868-63-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4868-188-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/4868-65-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4868-71-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5136-290-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5136-298-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5136-299-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5136-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5136-104-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5136-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5448-264-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5448-318-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5448-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5448-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5448-93-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5448-90-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5504-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5504-111-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5504-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5504-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5632-0-0x0000000000400000-0x0000000000854000-memory.dmp

Download

memory/5632-80-0x0000000000400000-0x0000000000854000-memory.dmp

Download

memory/5632-1-0x0000000002700000-0x0000000002766000-memory.dmp

Download

memory/5632-7-0x0000000002700000-0x0000000002766000-memory.dmp

Download

memory/5632-3-0x0000000002700000-0x0000000002766000-memory.dmp

Download

memory/5632-6-0x0000000002700000-0x0000000002766000-memory.dmp

Download

memory/5640-329-0x00000282111D0000-0x000002821124C000-memory.dmp

Download

memory/5640-581-0x00000282111D0000-0x000002821124C000-memory.dmp

Download

memory/5936-118-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5936-300-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5936-121-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5936-113-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/6076-501-0x000001F900030000-0x000001F900104000-memory.dmp

Download